Skill Build Helper

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:56 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed helper for creating and reviewing OpenClaw skills, with no hidden code, network fetches, or persistence beyond user-directed skill files.

Install only if you want an agent to help author or edit OpenClaw skills. Review any generated SKILL.md carefully before publishing or enabling it, because generated skill instructions can affect future agent behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Ae1

High

• Category: analysis-evasion

Content

**If optimizing**: Read the existing `SKILL.md` and note its current structure before proceeding.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Self-Modification

High

• Category: Rogue Agent

Content

| User says | Mode | Action |
|-----------|------|--------|
| "I want to create a skill that tracks my reading list" | Create | Scaffold `reading-track/`, gather examples, write SKILL.md + README.md |
| "Can you review my sm-saver skill?" | Optimize | Read `sm-saver/SKILL.md`, run checklist, report issues |
| "Build a skill for checking server status" | Create | Scaffold `server-check/`, gather examples, write SKILL.md + README.md |
| "Improve the reminder skill for ClawHub" | Optimize | Read `reminder/SKILL.md`, run checklist, add README.md if missing |

• Confidence: 92% confidence
• Finding: This example instructs the agent to scaffold a skill directory and write SKILL.md and README.md, which is direct code/content generation that modifies agent-executed skill assets. Because this is a meta-skill for producing other skills, successful triggering can lead to self-modification or creation of new privileged instructions, which is risky if user intent is ambiguous or if generated content is unsafe.

Self-Modification

High

• Category: Rogue Agent

Content

|-----------|------|--------|
| "I want to create a skill that tracks my reading list" | Create | Scaffold `reading-track/`, gather examples, write SKILL.md + README.md |
| "Can you review my sm-saver skill?" | Optimize | Read `sm-saver/SKILL.md`, run checklist, report issues |
| "Build a skill for checking server status" | Create | Scaffold `server-check/`, gather examples, write SKILL.md + README.md |
| "Improve the reminder skill for ClawHub" | Optimize | Read `reminder/SKILL.md`, run checklist, add README.md if missing |

• Confidence: 92% confidence
• Finding: This example again directs the agent to scaffold a new skill and write its instruction files, enabling creation of new executable agent behavior. In the context of a skill-builder, that means the skill can author additional skills or alter the local skill set, which materially increases the risk of persistence, unsafe instruction propagation, or unintended repository changes.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description is broadly scoped to creating, improving, reviewing, and publishing skills, which can overlap with many generic development-assistance requests. Overbroad activation increases the chance this meta-skill is invoked in situations where file creation or modification was not the safest or most appropriate action, expanding the attack surface for unintended self-modification workflows.

Static analysis

No suspicious patterns detected.